A newly disclosed vulnerability in Linux's Kernel-based Virtual Machine (KVM) could allow an attacker with kernel-level control inside a nested virtual machine to break out of virtualization boundaries and execute code on the underlying host system under specific conditions.
Tracked as CVE-2026-64561 and dubbed Zapscape, the flaw affects KVM's x86 shadow memory management unit (MMU), a core component responsible for maintaining shadow page tables that translate memory between guest virtual machines and the host. Security researcher Hyunwoo Kim, who identified and disclosed the issue, demonstrated that the vulnerability can be leveraged to execute commands on the host with root privileges.
The issue has been addressed upstream, and administrators operating KVM environments that expose nested virtualization to untrusted virtual machines are advised to deploy patched kernel releases or vendor packages containing the backported fix.
Unlike conventional virtualization deployments where guest systems operate in isolation from the host, nested virtualization allows a virtual machine to function as a hypervisor itself. In this configuration, an L1 guest can create and manage additional virtual machines, commonly referred to as L2 guests. While this capability is widely used for cloud infrastructure testing, development environments, virtualization research, and continuous integration workloads, it also introduces additional complexity into memory management, making implementation flaws particularly impactful.
Zapscape requires an attacker to already possess kernel-level privileges inside an L1 guest, which generally translates to root access within that virtual machine. On Intel-based systems, exploitation additionally depends on exposing both Extended Page Table (EPT) page-walk lengths four and five to the L1 guest. AMD platforms do not impose this additional requirement.
At the heart of the vulnerability is a flaw in the ordering of stale-root validation within KVM's shadow MMU bookkeeping. The weakness results in a use-after-free condition, a class of memory safety bug in which software continues interacting with memory after it has already been released.
According to Kim's technical analysis, the issue occurs while KVM is servicing guest-triggered page faults. During this process, KVM may reclaim shadow MMU pages to free memory resources. That reclamation can invalidate the shadow MMU root page currently being used by the ongoing page-fault handling routine. However, because the fault-handling path fails to verify that the root remains valid after the reclamation step, execution continues using an object that has already become stale.
The researcher explained that the vulnerability originates within KVM's recursive "zap" path, which is responsible for reclaiming shadow MMU pages. Before additional MMU pages are made available, KVM performs an initial stale-root validation. The problem arises because the subsequent reclamation process can invalidate that same root after the check has already completed. Rather than restarting with a fresh and valid root, KVM proceeds to construct new child shadow pages beneath the invalid parent.
Those newly created child pages inherit the parent's invalid state while simultaneously being inserted into KVM's active MMU page list. During later cleanup operations, the same list entry can become attached to multiple linked lists simultaneously. Eventually, the affected page may be freed even though stale references continue pointing to it, leaving behind a dangling pointer and enabling writes to memory that should no longer be accessible.
Such memory corruption primitives can provide the foundation for privilege escalation and virtualization escape techniques, particularly when an attacker already controls a privileged guest operating system.
To demonstrate the vulnerability, Kim released a public proof-of-concept that exploits the bug to create a root-owned file named /Zapscape on the vulnerable Linux host, illustrating successful code execution beyond the guest boundary.
The proof-of-concept was developed against AMD nested virtualization using Secure Virtual Machine (SVM) and Nested Page Tables (NPT) on Linux 7.1.3. For safe experimentation, Kim recommends running the demonstration under QEMU's Tiny Code Generator (TCG) mode. However, the researcher emphasized that QEMU itself is not affected by the vulnerability. Instead, the flaw resides entirely within the Linux kernel's KVM implementation and can be triggered independently of QEMU's device emulation.
Although exploit code is publicly available, Kim cautioned that the demonstration should not be interpreted as an immediately deployable attack against production cloud infrastructure. In its current form, the proof-of-concept requires additional engineering before it could be adapted for real-world environments. Among other changes, portions of the L1 guest activity would need to be moved into a guest kernel module, while the exploit
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: